# hollowpoint.rules — generated 2026-09-15 09:38 UTC — 38 rules — TLP:CLEAR
# source: https://publicmosaic.com/indicators — published for defensive use
# scope: asn 9924 — https://publicmosaic.com/asn/9924
# rev:2 — alert tcp on address and port; alert tls with tls.cert_fingerprint only where the full
#   certificate SHA-256 is published. REPLACE any rev:1 file (every rule was alert tls) rather than
#   loading it beside this one: a same-sid different-text pair is a duplicate Suricata refuses.
# live set only — archived episodes omitted: 0
# Rules may lag a withdrawal by up to five minutes (edge cache); the hub page is authoritative.
alert tcp $HOME_NET any -> 210.208.104.156 37194 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105053; rev:2;)
alert tcp $HOME_NET any -> 210.208.106.68 38386 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105224; rev:2;)
alert tcp $HOME_NET any -> 210.208.106.68 47841 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103768; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.4 37579 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105223; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.4 43380 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103844; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.20 50244 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105636; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.20 60482 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103767; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.21 35078 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105023; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.21 58400 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103766; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.42 48170 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101886; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.42 48479 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105024; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.51 41738 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101908; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.51 43845 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105594; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.51 55006 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106136; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.130 35632 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101909; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.130 43841 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105222; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.147 49159 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101887; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.147 59877 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105221; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.172 36904 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101910; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.172 46277 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106092; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.221 40213 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101911; rev:2;)
alert tcp $HOME_NET any -> 210.208.110.221 56269 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104904; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.2 34156 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9106135; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.2 48376 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101912; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.26 33341 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105220; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.26 49470 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101888; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.36 38915 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101889; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.36 50488 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105219; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.74 50244 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105218; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.74 59088 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103843; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.100 46099 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101890; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.100 56274 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105217; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.220 37183 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103765; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.220 50143 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105216; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.234 42818 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9101891; rev:2;)
alert tcp $HOME_NET any -> 210.208.111.234 49349 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9105593; rev:2;)
alert tcp $HOME_NET any -> 210.208.116.107 34736 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9103754; rev:2;)
alert tcp $HOME_NET any -> 210.208.116.107 44471 (msg:"HOLLOWPOINT infected device mozi"; reference:url,publicmosaic.com/indicators; sid:9104903; rev:2;)